I locked myself out of my AWS machine by changing ssh settings maybe?

Question

I'm not sure exactly what caused the problem but I'll tell you know I know.

I created an amazon ec2 instance and was using public/private key authentication to ssh in as the default ubuntu user. Everything was working fine until...

I had to create another user and give her ssh access. I wanted to give her a user/password login. So I added her as a non-sudo user and then modified my sshd_config. These are the two settings

PasswordAuthentication yes ### changed from no
AllowedUsers newuser1 ### this line was created

I tested to make sure I could ssh in with the new user and her password.

I also didn't want that user to be able to access or view my root user's home directory. So I executed "chmod -R o-rx /home/ubuntu".

The next day I try to ssh in as ubuntu as normal and the system prompts me for a password. Unfortunately I never set/changed the default user's password and I don't know what it is. I'm not sure why it's not just letting me log in with my private key.

Could it be my ssh server settings? Did I accidentally require passwords for all accounts even if their public key is in the ~/.ssh/authorized_keys file? Or did my changing of read/execute permissions on the ubuntu user prevent the reading of its authorized_keys file by the system?

Also, what can I do to log in as the root user again? I can still log in as the newuser but it doesn't have sudo privileges and I can't become a sudo user since I don't have the password.

Please help. Thanks in advance

Answer 1

The more correct solution would have been for her to give you her public key so you could create a user and add that public key to the user's ~/.ssh/authorized_keys file.

Assuming what you actually did was AllowUsers newuser1 then what you've done is blocked yourself, because you failed to list yourself.

You're getting prompted for a password because sshd will now prompt everybody for a password. Even if you had set a password, it wouldn't work, since your user is no longer allowed to access the machine via ssh.

Next time remember to test your own login from another window.

You're locked out, and the only workaround is to stop the instance, start a new one (or use another existing one if you have one, either way it must be in the same availability zone), detach the root disk, attach it to another instance, mount it, fix the misconfiguration, unmount, detach, reattach to the original instance, and start it up again.